An Information Technology (IT) Incident Management strives to restore normal service operations quickly to minimize business impact, thus ensuring high levels of service quality and availability. An incident is any event which is not part of the standard operation of a service and which causes, or may cause, an interruption to or a reduction in the quality of that service. Incidents are the result of failures or errors in IT infrastructure. A reported or logged incident is also referred to as a ticket, an incident ticket or a problem ticket interchangeably in this disclosure. Incident management becomes more important as IT's contribution to business grows. It also faces increasing challenges because an enterprise often maintains many applications in a shared IT environment composed of thousands of interdependent IT components, e.g., network, hardware, software etc. Incident diagnosis often requires investigation on complicated causes aggregated from this environment. For example, identifying the nature and cause of an IT incident by examining the symptoms, is a challenge because modern enterprise IT infrastructure shares multiple layers of IT components (applications, operating systems, middleware, servers, hardware, storage, network, and others) in a complicated manner. An IT incident is rarely an isolated incident.